2.5

Table Of Contents
VMware, Inc. 21
Chapter 2 Planning an ACE Management Server Deployment
SensitiveconfigurationoptionsareencryptedPasswordsstoredinthe
configurationfileareencrypted.
DatabasesecurityThedatabasestorecontainssensitivedatasuchas
cryptographickeys.Configureyourdatabasesecuritysothatitisprotectedfrom
intrusionandprotectedincaseofdataloss.Formoreinformationaboutfeatures
thatareavailabletoprotectyourdata,seeyourdatabasedocumentation.)
SSLencryptsdatathrough
theuseofapublickeyandprivatekeypair.Thepublickey
isknowntoeveryoneandtheprivatekeyisknownonlytothemessagerecipient.
URLs thatrequireanSSLconnectionstartwithhttps.
DuringACEManagementServerinstallation,thefollowingtwofilesarecreated:
server.keyAnRSA1024bitkey,thisistheprivatekey.
server.crtAselfsignedcertificate.Itssignatureisverifiedbythepublickey,
whichisembeddedinthecertificate.Thispubliccertificateisvalidfor10years
fromthedateandtimeatwhichtheserverisinstalled.Thecertificatefileis
encodedinPEMformat.
Bydefault,thesefiles
arestoredintheSSLdirectoryintheVMwareACEManagement
Serverprogramdirectory.
VMwarePlayer,whichrunstheACEinstances,doesnottrustanycertificatesstoredon
thehostmachineonwhichitisrunning.Instead,itreliesonacompletecertification
chainthatisincludedintheACE
package.Usingselfsignedcertificatesisadequatefor
mostsecurityneeds.
Youcan,however,useacertificateissuedbyacertificateauthority.Ifyouhavemultiple
ACEManagementServerinstances,youcanuseonecertificateforalloryoucanusea
differentcertificateoneachone.
Using SSL Certificates and Protocol
WhenanACEenabledvirtualmachineconnectstoanACEManagementServer,it
downloadsthepubliccertificateforthatserverandanychainofcertificatesrequiredto
verifytheserverspubliccertificate.Aservercertificatemighthaveachainofseveral
certificatesthatmustbeverifiedstepbystepuntilthe
verificationprocessreachesthe
root,ortrusted,certificateinthecertificatestore.Thefirsttimeaconnectionismadeto
aserverbyanyACEenabledvirtualmachineonaWorkstationadministratormachine,
thecertificateanditsverificationaredownloadedtotheWorkstationhostsystem.